Mondula2016 vulnerabilities
3 vulnerabilities
Known vulnerabilities in Mondula2016 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 1 product.
Products
1- Multi Step Form3 vulnerabilities
CVE-2025-9515mondula2016multi step form+1
EPSS score0.66%
The Multi Step Form plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the import functionality in all versions up to, and including, 1.7.25. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.CVE-2024-12427mondulamulti_step_form+2EPSS score0.40%
The Multi Step Form plugin for WordPress is vulnerable to unauthorized limited file upload due to a missing capability check on the fw_upload_file AJAX action in all versions up to, and including, 1.7.23. This makes it possible for unauthenticated attackers to upload limited file types such as images.CVE-2024-50428mondulamulti_step_form+2EPSS score0.33%
Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.